Help us improve
Share bugs, ideas, or general feedback.
How this skill is triggered — by the user, by Claude, or both
Slash command
/godmode:devsecopsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- User invokes `/godmode:devsecops`
Integrates SAST (Semgrep), DAST (OWASP ZAP), SCA/container scanning (Trivy), and secrets detection (Gitleaks) into CI/CD pipelines using GitHub Actions, GitLab CI, or Jenkins. For DevSecOps setup and shift-left security.
Integrates SAST, DAST, and SCA into CI/CD pipelines using Semgrep, Trivy, OWASP ZAP, and Gitleaks for automated security scanning.
Guides implementing SAST (CodeQL, Semgrep, SonarQube), SCA (Dependabot, Snyk, Trivy), DAST, and secrets scanning in CI/CD pipelines on every PR/commit to catch vulnerabilities early. For new/existing pipelines and compliance.
Share bugs, ideas, or general feedback.
/godmode:devsecops/godmode:pentest reveals issues to catch automatically/godmode:cicd needs security controls integratedEvaluate the current CI/CD pipeline security posture:
PIPELINE SECURITY ASSESSMENT:
CI/CD Platform: <GitHub Actions | GitLab CI | Jenkins |
CircleCI | Azure DevOps | Bitbucket>
Source control: <GitHub | GitLab | Bitbucket | Azure Repos>
Artifact registry: <Docker Hub | ECR | GCR | ACR | GHCR>
Deployment target: <K8s | ECS | Lambda | VMs | PaaS>
CURRENT SECURITY CONTROLS:
┌────────────────────┬──────────┬───────────────────────┐
| | Control | Status | Tool | |
├────────────────────┼──────────┼───────────────────────┤
| | SAST | YES/NO | <tool or none> | |
| | DAST | YES/NO | <tool or none> | |
...
Configure static code analysis for security vulnerabilities.
All security workflows share a common trigger (adjust per org policy):
# Common trigger pattern for all security scanning workflows
on:
pull_request:
branches: [main]
push:
branches: [main]
#.github/workflows/sast-semgrep.yml
name: SAST — Semgrep
# trigger: on pull_request + push to main (see common trigger pattern)
SEMGREP CONFIGURATION:
Rulesets:
- auto (Semgrep-curated rules for detected languages)
- p/owasp-top-ten (OWASP Top 10 coverage)
- p/cwe-top-25 (CWE Top 25 most dangerous weaknesses)
- p/security-audit (broad security patterns)
- p/<language>-security (language-specific rules)
Custom rules directory:.semgrep/
Create custom rules for project-specific patterns:
- Banned functions (eval, exec, unsafe APIs)
- Required patterns (input validation on routes)
...
#.github/workflows/sast-codeql.yml
name: SAST — CodeQL
# trigger: same as Semgrep (PR + push to main)
CODEQL CONFIGURATION:
Query suites:
- security-extended: Known vulnerability patterns + extended coverage
- security-and-quality: Security + code quality issues
- Custom query packs for organization-specific rules
Advantages over pattern-matching:
- Data flow analysis (tracks tainted input through function calls)
- Control flow analysis (understands branching and conditions)
- Type-aware analysis (understands object types and inheritance)
- Inter-procedural analysis (follows data across function boundaries)
...
Configure runtime security testing against running applications:
#.github/workflows/dast-zap.yml
name: DAST — OWASP ZAP
# uses common trigger above (add workflow_dispatch for manual full scans)
ZAP CONFIGURATION:
Scan types:
Baseline scan: Passive scanning + spider (fast, every PR)
Full scan: Active scanning + fuzzing (slow, scheduled/manual)
API scan: OpenAPI/Swagger spec-driven testing
Rules file (.zap/rules.tsv):
10016 WARN (Web Browser XSS Protection Not Enabled)
10017 WARN (Cross-Domain JavaScript Source File Inclusion)
10021 FAIL (X-Content-Type-Options Header Missing)
10038 FAIL (Content Security Policy Header Not Set)
40012 FAIL (Cross Site Scripting - Reflected)
...
Scan dependencies for known vulnerabilities and license issues:
#.github/workflows/sca.yml
name: SCA — Dependency Security
# trigger: PR + push to main
SCA CONFIGURATION:
Dependency Scanning Strategy
| Tool | Purpose | When |
|--|--|--|
| Dependabot/Renovate | Auto-update PRs | Daily |
| Snyk | Deep vuln analysis | Every PR + daily |
| npm/pip/cargo audit | Native scanning | Every PR |
| SBOM generator | Supply chain | Every release |
| License checker | Compliance | Every PR |
SEVERITY POLICY:
CRITICAL: Block merge + alert security team immediately
HIGH: Block merge + create ticket
Scan container images for vulnerabilities:
#.github/workflows/container-scan-trivy.yml
name: Container Scan — Trivy
# trigger: push to main (scan built images)
TRIVY SCAN TYPES:
image: Scan container images for OS and library vulnerabilities
fs: Scan filesystem for vulnerabilities in lockfiles
config: Scan IaC files (Dockerfile, Kubernetes YAML, Terraform)
repo: Scan git repository
sbom: Generate and scan SBOM
CONTAINER HARDENING CHECKS:
- [ ] Base image uses minimal distro (alpine, distroless, scratch)
- [ ] Base image tag is pinned (not :latest)
- [ ] Multi-stage build (build deps not in final image)
- [ ] Non-root user (USER directive in Dockerfile)
...
Prevent secrets from reaching the repository:
#.github/workflows/secret-scan.yml
name: Secret Scanning
# trigger: on all PRs and pushes (catch secrets before merge)
SECRET SCANNING LAYERS:
| Layer | Tool | When |
|--|--|--|
| Pre-commit (local) | gitleaks hook | Before every commit |
| PR check (CI) | gitleaks action | Every pull request |
| Push protection | GitHub/GitLab | Every push |
| Scheduled scan | trufflehog | Daily full scan |
| Runtime detection | detect-secrets | Baseline tracking |
CUSTOM PATTERNS:
.gitleaks.toml:
[[rules]]
id = "internal-api-key"
...
Define blocking security checks that prevent insecure deployments:
SECURITY GATE CONFIGURATION:
| Gate | Stage | Action | Override |
|--|--|--|--|
| SAST findings | PR check | BLOCK | Security team |
| SCA critical CVE | PR check | BLOCK | Security team |
| Secret detected | PR check | BLOCK | No override |
| DAST high vuln | Pre-deploy | BLOCK | Security team |
| Container CVE | Pre-deploy | BLOCK | Security team |
| SBOM missing | Pre-deploy | BLOCK | Release eng |
| License violation | PR check | WARN | Legal team |
| IaC misconfig | PR check | BLOCK | Platform team |
| Unsigned artifact | Pre-deploy | BLOCK | No override |
...
Scan infrastructure definitions for misconfigurations:
IAC SECURITY CHECKS:
| Category | Examples |
|--|--|
| Cloud misconfig | Public S3 buckets, open SGs |
| Kubernetes security | Privileged containers, no limits |
| Docker hardening | Root user, missing healthcheck |
| Terraform state | Remote state with encryption |
| Network exposure | 0.0.0.0/0 ingress rules |
| Encryption | Unencrypted storage/databases |
| Logging | Missing audit trails |
| IAM | Overly permissive policies |
SECURITY METRICS DASHBOARD: SECURITY POSTURE — Open vulnerabilities: CRITICAL (SLA:24h), HIGH (SLA:7d), MEDIUM (SLA:30d), LOW (SLA:90d) Pipeline: PRs blocked /week, avg fix time CRITICAL , HIGH , override rate % Dependencies: total , vulnerable , outdated , license violations Containers: production , CRITICAL CVEs , :latest tag (target 0), non-root / Trend: IMPROVING | STABLE | DEGRADING
### Step 10: Commit and Transition
.github/workflows/ or equivalent CI directorysecurity/pipeline-policy.yml/godmode:pentest to
validate or /godmode:ship to deploy."
## Key Behaviors
Never ask to continue. Loop autonomously until done.
```bash
# Run security scans locally
npx semgrep scan --config auto src/
trivy image --severity CRITICAL,HIGH myapp:latest
gitleaks detect --source . --verbose
npx @cyclonedx/cyclonedx-npm --output-file sbom.json
IF CRITICAL findings > 0: block merge, SLA < 24 hours. WHEN secret detected in git history: rotate immediately, BFG to remove. IF scanner runtime > 5 minutes in CI: scope to changed files only.
KEEP if: true positive, affects production, CRITICAL/HIGH severity
DISCARD if: false positive with justification OR already excepted
Exceptions: max 30 day expiry, documented, reviewed
STOP when: all target maturity controls ACTIVE, CRITICAL/HIGH block merge, secret scanning on 3 layers, SBOM generated per release.
1. Check CI/CD platform:
- Scan for.github/workflows/ → GitHub Actions
- Scan for.gitlab-ci.yml → GitLab CI
- Scan for Jenkinsfile → Jenkins
- Scan for azure-pipelines.yml → Azure DevOps
2. Check existing security controls:
- Scan workflows for semgrep, codeql, sonar, snyk, trivy, gitleaks, trufflehog, checkov, tfsec
- Check for.gitleaks.toml,.semgrep/, sonar-project.properties
- Check for cosign, notation references (artifact signing)